We have the We use the Panther Analysis Tool to manage our detections setting toggled to ON
in our Panther instance. Are we be able to disable Panther Detection Packs from the Console?
No, you are not able to make changes to Detection Packs in the Panther Console if the We use the Panther Analysis Tool to manage our detections setting is enabled.
If you are experiencing issues as a result of using Detection Packs in both the Console and CI/CD workflows together (which we do not recommend), follow these steps to restore the proper state:
Temporarily toggle the We use the Panther Analysis Tool to manage our detections to OFF
.
Navigate to Build > Packs.
Disable each of your enabled Panther Detection Packs.
Wait a few minutes. Pack updates are asynchronous and may not immediately reflect in the console.
If needed, perform another push from your CI/CD workflow to ensure that everything syncs up as expected.
Toggle the We use the Panther Analysis Tool to manage our detections back to ON
to prevent users from enabling a Pack in the Console.